[SECURITY] Fedora 31 Update: ImageMagick-6.9.10.75-1.fc31

ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed wor...

Security Update for Microsoft Visual Studio Code (CVE-2019-1414)

The version of Microsoft Visual Studio Code installed on the remote Windows host is prior to 1.39.1. It is, therefore, affected by the following vulnerability: - An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer. A...

Tainted Data Can Teach Algorithms the Wrong Lessons

Researchers show how AI programs can be sabotaged by even subtle tweaks to the data used to train them...

High-Severity Windows UAC Flaw Enables Privilege Escalation

Researchers disclosed details of a high-severity Microsoft Windows vulnerability that could give attackers elevated privileges – ultimately allowing them to install programs, and view, change or delete data. The bug stems from User Account Control UAC, a security feature of Windows within Secure...

GNU C Library ASLR Bypass Vulnerability

The GNU C Library glibc is an open-source, free, easy-to-download C compiler released under the LGPL license. An ASLR bypass vulnerability exists in GNU C Library glibc versions prior to 2.31 on the x86-64 architecture. The vulnerability stems from GNU C Library failing to ignore the...

CVE-2019-19126

On the x86-64 architecture, the GNU C Library aka glibc before 2.31 fails to ignore the LDPREFERMAP32BITEXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for...

Stealthy Malware Flies Under AV Radar with Advanced Obfuscation

Researchers warn hackers are putting a new spin on old injection techniques and successfully end-running endpoint protection. They are tracking a campaign, that kicked off in January, that is still going strong exploiting weaknesses in web browsers. The objective is to hide in the background of...

Orcus RAT Author Charged in Malware Scheme

In July 2016, KrebsOnSecurity published a story identifying a Toronto man as the author of the Orcus RAT, a software product that’s been marketed on underground forums and used in countless malware attacks since its creation in 2015. This week, Canadian authorities criminally charged him with...

[SECURITY] Fedora 31 Update: kernel-headers-5.3.11-300.fc31

Kernel-headers includes the C header files that specify the interface between the Linux kernel and userspace libraries and programs. The header files define structures and constants that are needed for building most standard programs and are also needed for rebuilding the glibc package...

Windows UPnP Service Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play UPnP service improperly allows COM object creation. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs;...

[SECURITY] Fedora 29 Update: t1utils-1.41-1.fc29

t1utils is a collection of programs for manipulating PostScript type 1 and type 2 fonts containing programs to convert between PFA ASCII format, PFB binary format, a human-readable and editable ASCII format, and Macintosh resource forks...

[SECURITY] Fedora 30 Update: t1utils-1.41-1.fc30

t1utils is a collection of programs for manipulating PostScript type 1 and type 2 fonts containing programs to convert between PFA ASCII format, PFB binary format, a human-readable and editable ASCII format, and Macintosh resource forks...

The vulnerability of the Client programs component of the MySQL Server database management system allows attackers to disclose sensitive information.

The vulnerability of the Client programs in the MySQL Server database management system is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker to disclose the protected information...

Cisco Talos helps CISOs get back to basics with advisory series

At Cisco Talos, we try to build detections for every threat we see to provide customers with a portfolio capable of identifying and stopping threats at various stages of an attack's lifecycle. Deploying the best suite of layered security tools is an integral part of protecting an organization. Bu...

MS14-082: Description of the security update for Microsoft Office 2013: December 9, 2014

MS14-082: Description of the security update for Microsoft Office 2013: December 9, 2014 Introduction This security update resolves a vulnerability that could allow remote code execution if a specially crafted file is opened in an affected edition of Microsoft Office. Summary Microsoft has releas...

ThreatList: Most Retail Hardware Bug Bounty Flaws Are Critical

Almost all of hardware vulnerabilities – 90 percent – that were submitted to retail bug bounty programs so far this year were categorized as critical, showing that Point of Sale systems and other retail hardware assets remain a serious security issue. That’s due to the fact that retail hardware...

CVE-2019-2969

Vulnerability in the MySQL Server product of Oracle MySQL component: Client programs. Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL...

UBUNTU-CVE-2019-2969

Vulnerability in the MySQL Server product of Oracle MySQL component: Client programs. Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL...

HackerOne: Private program disclosure via `vpn_suspended` GraphQL query

Summary: vpnsuspended of Team object got exposed Description: An attacker can get vpnsuspended value of any program including external program which also have private program eg. █████ and external program which does not have private program What an attacker can do with this ? If an external...

Oracle MySQL Server Information Disclosure Vulnerability (CNVD-2019-36882)

MySQL Server mysqld is the MySQL server, the main program that performs most of the work in a MySQL installation. An information disclosure vulnerability exists in the Client programs component of Oracle MySQL Server 5.6.44, 5.7.26, 8.0.16 and earlier versions. An attacker can exploit this...